hxxp://discord[.]com/login

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 10:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://discord.com/login

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	discord.com
9	discord.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1705699165-553239100-4129523827-1000\{1A212EE6-6E4C-446B-9A97-6F186AEBDE10}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4452	msedge.exe
4452	msedge.exe
2800	msedge.exe
2800	msedge.exe
2952	msedge.exe
2952	msedge.exe
2072	identity_helper.exe
2072	identity_helper.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2000	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2000	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 1408	2800	msedge.exe	83
PID 2800 wrote to memory of 1408	2800	msedge.exe	83
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 2052	2800	msedge.exe	84
PID 2800 wrote to memory of 4452	2800	msedge.exe	85
PID 2800 wrote to memory of 4452	2800	msedge.exe	85
PID 2800 wrote to memory of 1628	2800	msedge.exe	86
PID 2800 wrote to memory of 1628	2800	msedge.exe	86
PID 2800 wrote to memory of 1628	2800	msedge.exe	86
PID 2800 wrote to memory of 1628	2800	msedge.exe	86
PID 2800 wrote to memory of 1628	2800	msedge.exe	86
PID 2800 wrote to memory of 1628	2800	msedge.exe	86
PID 2800 wrote to memory of 1628	2800	msedge.exe	86
PID 2800 wrote to memory of 1628	2800	msedge.exe	86
PID 2800 wrote to memory of 1628	2800	msedge.exe	86
PID 2800 wrote to memory of 1628	2800	msedge.exe	86
PID 2800 wrote to memory of 1628	2800	msedge.exe	86
PID 2800 wrote to memory of 1628	2800	msedge.exe	86
PID 2800 wrote to memory of 1628	2800	msedge.exe	86
PID 2800 wrote to memory of 1628	2800	msedge.exe	86
PID 2800 wrote to memory of 1628	2800	msedge.exe	86
PID 2800 wrote to memory of 1628	2800	msedge.exe	86
PID 2800 wrote to memory of 1628	2800	msedge.exe	86
PID 2800 wrote to memory of 1628	2800	msedge.exe	86
PID 2800 wrote to memory of 1628	2800	msedge.exe	86
PID 2800 wrote to memory of 1628	2800	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://discord.com/login
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa8ddb46f8,0x7ffa8ddb4708,0x7ffa8ddb4718
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,7335151580218751390,9965133420361405590,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2252,7335151580218751390,9965133420361405590,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2252,7335151580218751390,9965133420361405590,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,7335151580218751390,9965133420361405590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,7335151580218751390,9965133420361405590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,7335151580218751390,9965133420361405590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2252,7335151580218751390,9965133420361405590,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4224 /prefetch:8
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2252,7335151580218751390,9965133420361405590,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=2016 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2252,7335151580218751390,9965133420361405590,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2252,7335151580218751390,9965133420361405590,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,7335151580218751390,9965133420361405590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,7335151580218751390,9965133420361405590,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,7335151580218751390,9965133420361405590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,7335151580218751390,9965133420361405590,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,7335151580218751390,9965133420361405590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,7335151580218751390,9965133420361405590,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6180 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2644

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x304 0x41c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bafce9e4c53a0cb85310891b6b21791b

SHA1
5d70027cc137a7cbb38f5801b15fd97b05e89ee2

SHA256
71fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00

SHA512
c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a499254d6b5d91f97eb7a86e5f8ca573

SHA1
03dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1

SHA256
fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499

SHA512
d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
89836dc305d57b4aae3f806a655bd4c8

SHA1
558f2fea18761e50a84fc2cee50abb20940b75b3

SHA256
e0adeac84016df6508746532e949cb0e94c1a4198b7dd8cd0b8cb6c02fe478cc

SHA512
0e3189cec20ecd483d046d5d4c3566a5b8a81ee12fa92a687b1a7c682a8cedb6ed9073e3a5b67d89cbafef3dd106344b724f631ccb246f55c6bdeab396af068b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
54c9a5f96c406277d7ff59048ab1faf8

SHA1
b4d090a72f14c18ee39ee7b0c48c843d43688958

SHA256
26ad6f96c5f4e46b3113c385e340184d551c7cbf92a4ad21547650f0f2d5150e

SHA512
b3f11294272e489ed3f61ef66db2ab1166cd574b8d36afb49e7d0ae0769b586edefb6c49d845a7d265209481cc45e59ec91537d30056079f38b10c8803d7d7ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
931933d8028aa19547585c5d8f9a5a27

SHA1
e7a3f9e812e28af7612e0ef14a35acd455754cc6

SHA256
1873058fca7c88cd8b1d9a1ec4f9b7a67950394b85f40107e473f160ab6e5351

SHA512
94829c67d61cbcf8a2fcf1c722596c85b7d404c90ee74dff2879316549552bf08b53acc04443d510bfc7435bf909ac13050d760b24612f7bd09b9223c9730af5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d4b6e9ccc84804894bc4d78181be44ed

SHA1
2092f128dc4f99b13b3de6046f69a2c3165c6859

SHA256
4063f6caad882191f2c4174e063b05b4ee284427ef9579974b84694c600cfe78

SHA512
272f2f24ace405a148b637a8eec52522ff9eb2e9324c05e2b73841f4656a154f55d7bf61d7386788feb290489cf57038049e19a927e812702de7a5fea9a83802

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
36b02cc2b0d814b98bbccdf11a82a29c

SHA1
52c03f073f2ed70fb29cbccddd8298774138274a

SHA256
4d1b61c8b30d06d530064574cd682872e5f56642b3a12d9d3e32d520b711880d

SHA512
0527923cb7f0020aefa7e6ab224e048cc185d443e0f855d8daa1338ad3e423232b1140fdae7d94e9bb5502c10c64af36bef2d83305008b8b978395c95799d4a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5500a5e5dc4db46c845887557ba589a2

SHA1
8e9fa3c4bef29b11dcccab4e56cf33d972fc97e5

SHA256
5d4c833e4b9ef23a463942172eec153b29228c28042374820ae20aa914616f51

SHA512
848363bf9573b4935e64e6e4096135e5d45c42c342f2464c817cf5a70b354eddfdef4e4957e02f769f41d4d6f5c700a00b922a0254837d41f6600de47c6f6c63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
efb8ffc55d0ac269332067699b242700

SHA1
dcb04c0666433f7bb21e0ed10dc39cad89cdac6a

SHA256
8ee2a3dea8c076744a6aaac91a5a6a0262cd9dac495a2b0479ffe3ecf553aab3

SHA512
e169e8147a5a884d8caae894709fbd01b5d95cc4e63eaec4f858357f5429442a7f6dda67e0c31667dfab80089e742a8d37601833d46ab3ab4deb3fe498e05dbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d11a18f0a3b6cd37f22f3323ad2b7375

SHA1
01b098d2fb730975b52a8fd00e192e0c6929afae

SHA256
f3b7d692e3de362675ba9bc94f17bfc6832e56586d7a69741da21f4f27e6ba27

SHA512
7c06ea031ca24445fd10d043f8a1b7263d40ecfca4573c1b90e52c2ac6ca0bcd591f1e8cce3117830ee5d275002c6657acad8cfd0457a0d2fc2ba0b718188cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
90ad8b2a6fe6845caf1903b18559892b

SHA1
acacfb90881c0e0f2918cf5397f93faa894cc754

SHA256
e47b9c578f8c385458824423f012fa3f20ccbb9976f0ed89dd28c5ba800482c1

SHA512
ae36b54f07e2b0ee0b9f0d1c33ac81ad21ef754469efc5f1b67ab0c5f1e28eda1090b2ea1768ba174874105f77dc7d81d22fb54e7a1332526840833ec6f17c23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1439b7b1fea65b066368de327e7fbf96

SHA1
4e836e6b6627a6bc78a29f171f97f2c3308c9a41

SHA256
8ff777b30d43c64a69ec9a998a34e4b021f04153badacc46eb7bfb2a911e6433

SHA512
5c1d87f918b90d6d76b6faa43251d7ff1275994a6b1cd97b9ea4c78069503fed624f950e1ffd98c3d5e81a5a1e77a0ce6d7566a3b460f1797718ce0051d7dcd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e929c4ae808407962bf951c7729871d0

SHA1
db63b2f592393c7baec4f554f1032870b1836932

SHA256
3c49bf1165b195066b5063075ce64ff7a598d9e8b1f3822e37790a428efbf795

SHA512
85452303b646d3be302296f00ac09ee3c31ef92696b84b9ce5766e978bef59a1d1d45428dcc59975d5501748a80d40657975362cc307a20a44272b4ab2767ec2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8cd8f35ba7dbda8cfb7b555a92f6e1d8

SHA1
7c2153dc301f6f6803308d0f328b53b7f7f0b293

SHA256
925c5aaf84e247f063a257469e9e4bc69e9d84bb2656f4c1264279d519e85ad3

SHA512
69cadeeb7f28c65c9f467dcd9cdd03ea505a40614460729aaa2a117a797cdde410e16090835912f993212299e65eef74eea7926fd70f9b37f9ff5e453696b39a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580ccc.TMP

Filesize
370B

MD5
12a9c6b578aff9f90a7593a2af6fdeb9

SHA1
a3c08b70037187cd69466fa9e86507a4142bfbf8

SHA256
9f099fc039b303ed0ef3933013b5c09d5820398281000fb353e19b2aba40ee38

SHA512
990b79b59d8592181e2d7fad2f8a7dc86c7735425e0da528c23e5c374d98b15fcf369e50334a08525e35c64090558461f167a7f5c056764876870168545db9b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
90a0342dbedb49294bf68354946b3b2c

SHA1
c6d5b704687f066b2364f9f7c67d714f9cc1f4a8

SHA256
5eb8da4b1e4cb6d11deda641e01fa1b5bedb1d90aece7183b693dfd5a13bac18

SHA512
f449479893ec28481d77ccca5e701ee3bbd283df02b5975ad668ba55e485e85a8d2fd501836951c292882532c084069e1d02cf33ec5f59bad910cb8df93f0962

Download Submit